What is the CVSS score of CVE-2026-2374?

CVE-2026-2374 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Login No Captcha reCAPTCHA are affected by CVE-2026-2374?

A stored cross-site scripting vulnerability in the Login No Captcha reCAPTCHA WordPress plugin (up to version 1.8.0) enables unauthenticated attackers to inject malicious code that executes in…

How to fix or mitigate CVE-2026-2374?

Within 24 hours: Inventory WordPress installations using the affected plugin (versions ≤ 1.8.0) and assess operational dependencies. Within 7 days: Disable the plugin if non-critical to operations, or restrict xmlrpc.php endpoint access via web server and deploy WAF rules to detect XSS payloads; enable enhanced monitoring of administrator login sessions. Within 30 days: Monitor vendor advisories for security updates; evaluate migration to alternative reCAPTCHA implementations or additional security controls.

Login No Captcha reCAPTCHA CVE-2026-2374

EUVD-2026-32704 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 Wordfence

GHSA-m5hx-7xc5-p76f

XSS PHP WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 05:01 vuln.today

CVE Published

May 28, 2026 - 03:27 nvd

HIGH 7.2

DescriptionCVE.org

The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $_SERVER['PHP_SELF'] superglobal in all versions up to, and including, 1.8.0. This is due to the authenticate() function storing the unsanitized output of basename($_SERVER['PHP_SELF']) in the login_nocaptcha_error WordPress option when a login attempt is made from a non-standard login page (e.g., xmlrpc.php). The admin_notices() function then echoes this stored value directly into the admin dashboard HTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator with a whitelisted IP address visits the WordPress dashboard within 30 seconds of the attack.

AnalysisAI

Stored cross-site scripting in the Login No Captcha reCAPTCHA WordPress plugin (versions up to and including 1.8.0) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in an administrator's browser session. The flaw, reported by Wordfence, stems from unsanitized handling of the PHP_SELF superglobal during failed logins via non-standard endpoints such as xmlrpc.php, with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) instance in PHP, affecting cpe:2.3:a:robertpeake:login_no_captcha_recaptcha. The plugin's authenticate() function calls basename($_SERVER['PHP_SELF']) and persists the result into the WordPress options table under the 'login_nocaptcha_error' key when a login attempt arrives from a non-standard entrypoint. Because PHP_SELF is attacker-controllable via path-info style URLs (e.g., /xmlrpc.php/<payload>), and because admin_notices() later echoes the stored value directly into the admin dashboard HTML without esc_html() or esc_attr() escaping, the result is persistent, stored XSS. The source references (plugins.trac.wordpress.org lines 281 and 377 of login-nocaptcha.php) point to the exact sink and storage locations.

RemediationAI

Upgrade the Login No Captcha reCAPTCHA plugin to a version newer than 1.8.0 as soon as the maintainer publishes one; the input data references an upstream changeset (plugins.trac.wordpress.org changeset 3549342) indicating an upstream fix is in progress but a released patched version is not independently confirmed from the supplied data. Until a fixed release is installed, compensating controls include: disabling or restricting xmlrpc.php at the web server level (note this will break legitimate XML-RPC clients such as the WordPress mobile app and Jetpack), removing or tightening the plugin's IP whitelist for admins so the 30-second post-attack visit cannot trigger payload execution, and deploying a WAF rule (e.g., Wordfence) that strips path-info from requests to /xmlrpc.php and other PHP entrypoints. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/99dfce3b-2b47-41bf-8b20-b53fb9f061a7 for vendor guidance and IoCs.